sssd-devel December 2018

sssd-devel@lists.fedorahosted.org

1 participants
41 discussions

[sssd PR#706][opened] KCM: Fall back to using the first ccache if the default does not exist
by jhrozek 27 Mar '19

27 Mar '19

URL: https://github.com/SSSD/sssd/pull/706 Author: jhrozek Title: #706: KCM: Fall back to using the first ccache if the default does not exist Action: opened PR body: """ Resolves: https://pagure.io/SSSD/sssd/issue/3838 KCM stores the default ccache in a separate DB entry. If the DB entry contains a UUID that cannot be found in the DB for whatever reason, we should just use the first ccache as the default. (This is what we already do if there is no default) """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/706/head:pr706 git checkout pr706

2 5

[sssd PR#650][opened] Implement a hybrid mode of generating private groups
by jhrozek 20 Mar '19

20 Mar '19

URL: https://github.com/SSSD/sssd/pull/650 Author: jhrozek Title: #650: Implement a hybrid mode of generating private groups Action: opened PR body: """ Related: https://pagure.io/SSSD/sssd/issue/3822 Design page PR: https://pagure.io/SSSD/docs/pull-request/72 Commit mesages follow, hopefully they are enough to explain what is going on. SYSDB: Special case getgrnam and getgrgid searches in hybrid MPG mode In hybrid MPG mode, we want to return the MPG group only in case the user entry has no original GID set. To achieve this, we first search with the non-MPG filter to find 'real' groups. If that fails, we try the MPG filter, but throw away entries that has any real GID set. Related: https://pagure.io/SSSD/sssd/issue/3822 SYSDB: Refactor the mpg and non-mpg searches out of sysdb_getgrnam() and sysdb_getgrgid() to make them more reusable The getgrnam and getgrgid searches already special-case lookups with overrides where in some cases the search falls back no a non-MPG search. The upcoming special case for the hybrid mode would do something similar, just in the opposite direction, so it makes sense to split out the functions for just the MPG step and just the non-MPG step into reusable functions. Related: https://pagure.io/SSSD/sssd/issue/3822 CONFDB/NSS: Add the hybrid MPG mode Permits a new option value 'hybrid' for the auto_private_groups option. The option was even previously marked as a string option in both the configAPI and the man pages, so we don't have to change the type now. If the hybrid mode is selected and the user's original GID number is available, then during initgroups and getpwnam, it is used as their primary GID instead of the MPG group. The original group is also not added as a secondary group during initgroups in this case. Related: https://pagure.io/SSSD/sssd/issue/3822 CONFDB: Read auto_private_groups as string, not bool In preparation to adding the third value of auto_private_groups, this patch reads the confdb value as string and checks for the option values on its own. Related: https://pagure.io/SSSD/sssd/issue/3822 UTIL: Convert bool mpg to an enum mpg_mode Instead of bool mpg inside struct sss_domain_info, let's introduce enum mpg_mode that currently maps pretty much 1:1 to the boolean. In future patches, a third value will be added. Also adds a getter for the mpg_mode value because we want to discourage getting or setting the value directly. Instead, the sss_domain_info structure should be opaque in the future. Related: https://pagure.io/SSSD/sssd/issue/3822 UTIL: Add a is_domain_mpg shorthand Instead of looking into the domain structure directly, add a sss_domain_is_mpg() function. This will make sense when we add a third state instead of the boolean that will also be mpg-like. Related: https://pagure.io/SSSD/sssd/issue/3822 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/650/head:pr650 git checkout pr650

2 59

[sssd PR#718][opened] NSS: Avoid changing the memory cache ownership away from the sssd user (sssd-1-16 backport)
by jhrozek 26 Feb '19

26 Feb '19

URL: https://github.com/SSSD/sssd/pull/718 Author: jhrozek Title: #718: NSS: Avoid changing the memory cache ownership away from the sssd user (sssd-1-16 backport) Action: opened PR body: """ Resolves: https://pagure.io/SSSD/sssd/issue/3890 In case SSSD is compiled --with-sssd-user but run as root (which is the default on RHEL and derivatives), then the memory cache will be owned by the user that sssd_nss runs as, so root. This conflicts with the packaging which specifies sssd.sssd as the owner. And in turn, this means that users can't reliably assess the package integrity using rpm -V. This patch makes sure that the memory cache files are chowned to sssd.sssd even if the nss responder runs as root. Also, this patch changes the sssd_nss responder so that is becomes a member of the supplementary sssd group. Even though in traditional UNIX sense, a process running as root could write to a file owned by sssd:sssd, with SELinux enforcing mode this becomes problematic as SELinux emits an error such as: type=AVC msg=audit(1543524888.125:1495): avc: denied { fsetid } for pid=7706 comm="sssd_nss" capability=4 scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:system_r:sssd_t:s0 tclass=capability To make it possible for the sssd_nss process to write to the files, the files are also made group-writable. The 'others' permission is still set to read only. Reviewed-by: Michal Židek <mzidek(a)redhat.com> (cherry picked from commit 61e4ba58934b20a950255e05797aca25aadc1242) """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/718/head:pr718 git checkout pr718

2 6

[sssd PR#712][opened] SSSCTL: user-checks does not show custom attributes
by thalman 05 Feb '19

05 Feb '19

URL: https://github.com/SSSD/sssd/pull/712 Author: thalman Title: #712: SSSCTL: user-checks does not show custom attributes Action: opened PR body: """ "sssctl user-checks" also query the IFP interface of sssd. The problem is, that this command only displays POSIX user attrs, no matter if we configured the InfoPipe for additional user attributes. With this patch additional attributes are also printed out. Resolves: https://pagure.io/SSSD/sssd/issue/3866 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/712/head:pr712 git checkout pr712

4 12

[sssd PR#721][opened] AD/IPA: Reset subdomain service name, not domain name
by jhrozek 28 Jan '19

28 Jan '19

URL: https://github.com/SSSD/sssd/pull/721 Author: jhrozek Title: #721: AD/IPA: Reset subdomain service name, not domain name Action: opened PR body: """ Related: https://pagure.io/SSSD/sssd/issue/3911 Since commit 778f241e78241b0d6b8734148175f8dee804f494 the subdomain fail over services use the "sd_" prefix. This was done to make it easier, until the whole failover design works better with subdomains, to see which services belong to the main domain from tools. However, some parts of the code would still just use the domain name for the failover service, which meant the service was not found, notably when trying to reset services: (Thu Dec 13 05:29:31 2018) [sssd[be[testrelm.test]]] [ipa_srv_ad_acct_retried] (0x0400): Subdomain re-set, will retry lookup (Thu Dec 13 05:29:31 2018) [sssd[be[testrelm.test]]] [be_fo_reset_svc] (0x1000): Resetting all servers in service ipaad2016.test (Thu Dec 13 05:29:31 2018) [sssd[be[testrelm.test]]] [be_fo_reset_svc] (0x0080): Cannot retrieve service [ipaad2016.test] This patch switches to reading the service names from the ad_options and the sdap_service structures that are contained within ad_options. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/721/head:pr721 git checkout pr721

2 4

[sssd PR#703][opened] nss: sssd returns '/' for emtpy home directories
by thalman 11 Jan '19

11 Jan '19

URL: https://github.com/SSSD/sssd/pull/703 Author: thalman Title: #703: nss: sssd returns '/' for emtpy home directories Action: opened PR body: """ For empty home directory in passwd file sssd returns "/". Sssd should respect system behaviour and return the same as nsswitch "files" module - return empty string. Resolves: https://pagure.io/SSSD/sssd/issue/ To be defined """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/703/head:pr703 git checkout pr703

4 30

[sssd PR#715][opened] Use 120 second default timeout for dbus (#1654537)
by AdamWill 08 Jan '19

08 Jan '19

URL: https://github.com/SSSD/sssd/pull/715 Author: AdamWill Title: #715: Use 120 second default timeout for dbus (#1654537) Action: opened PR body: """ As discussed in #1654537, first login to a system as a FreeIPA domain user now usually causes an expensive SELinux operation to happen; this can take longer than the default dbus message timeout of 25 seconds. To deal with this for now, let's use a 120 second default timeout; this is a big hammer, but unless we can refactor things to use a longer timeout just for that one call, or make the actual operation take less time, there's not much else we can do. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1654537 Signed-off-by: Adam Williamson <awilliam(a)redhat.com> """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/715/head:pr715 git checkout pr715

5 14

[sssd PR#719][opened] ifp: extraAttributes is UnknownProperty
by thalman 06 Jan '19

06 Jan '19

URL: https://github.com/SSSD/sssd/pull/719 Author: thalman Title: #719: ifp: extraAttributes is UnknownProperty Action: opened PR body: """ Attempting to get extraAttributes via SSSD's ifp fails. Here I uncomment interface function for extraAttributes. also right for querying this interface is changed to allow this request. Resolves: https://pagure.io/SSSD/sssd/issue/3906 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/719/head:pr719 git checkout pr719

2 10

[sssd PR#720][opened] contrib/ci/deps.sh: added missing dependency
by alexey-tikhonov 21 Dec '18

21 Dec '18

URL: https://github.com/SSSD/sssd/pull/720 Author: alexey-tikhonov Title: #720: contrib/ci/deps.sh: added missing dependency Action: opened PR body: """ Added libnss3-tools to list of debian dependencies: certutil from this package is required by test_pam_responder.py. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/720/head:pr720 git checkout pr720

4 9

[sssd PR#717][opened] NSS: Avoid changing the memory cache ownership away from the sssd user (sssd-1-16 backport)
by jhrozek 18 Dec '18

18 Dec '18

URL: https://github.com/SSSD/sssd/pull/717 Author: jhrozek Title: #717: NSS: Avoid changing the memory cache ownership away from the sssd user (sssd-1-16 backport) Action: opened PR body: """ Resolves: https://pagure.io/SSSD/sssd/issue/3890 In case SSSD is compiled --with-sssd-user but run as root (which is the default on RHEL and derivatives), then the memory cache will be owned by the user that sssd_nss runs as, so root. This conflicts with the packaging which specifies sssd.sssd as the owner. And in turn, this means that users can't reliably assess the package integrity using rpm -V. This patch makes sure that the memory cache files are chowned to sssd.sssd even if the nss responder runs as root. Also, this patch changes the sssd_nss responder so that is becomes a member of the supplementary sssd group. Even though in traditional UNIX sense, a process running as root could write to a file owned by sssd:sssd, with SELinux enforcing mode this becomes problematic as SELinux emits an error such as: type=AVC msg=audit(1543524888.125:1495): avc: denied { fsetid } for pid=7706 comm="sssd_nss" capability=4 scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:system_r:sssd_t:s0 tclass=capability To make it possible for the sssd_nss process to write to the files, the files are also made group-writable. The 'others' permission is still set to read only. Reviewed-by: Michal Židek <mzidek(a)redhat.com> (cherry picked from commit 61e4ba58934b20a950255e05797aca25aadc1242) """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/717/head:pr717 git checkout pr717

1 2

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel December 2018